'''
Created on 2009-9-1

@author: lz
'''

import pefile

filename = r'f:\tencent\21427-21434\S21703__51la[1].exe.v'

def test():
    pe = pefile.PE(filename)
    for section in pe.sections:
        print section.Name

def trandumpfile(filename):
    f = open(filename, 'r')
    lines = f.readlines()
    f.close()
    
    outf = open(r'e:\xp_share\dump.bin', 'wb')
    
    import binascii
    
    for line in lines:
        buffer = binascii.a2b_hex("".join(line.split()))
        outf.write(buffer)
    outf.close()

def get_overlay(filename):
    pe = pefile.PE(filename)
    filebuffer = pe.write()
    s = pe.sections[-1]

    print len(filebuffer)
    print s.PointerToRawData + s.SizeOfRawData
    if (len(filebuffer) > s.PointerToRawData + s.SizeOfRawData):
        return filebuffer[s.PointerToRawData + s.SizeOfRawData:]

def remove_overlay(filename):
    pass

if __name__ == '__main__':
#    trandumpfile(r'e:\xp_share\fdump.txt')
    filename = r'e:\xp_share\main.overlay.exe'
    get_overlay(filename)
